CIPA Update: SB 690 Is Law and Variety Media May Be Its First Casualty
October 2, 2026
Last month, we wrote that SB 690 would end most private "pen register" suits over website tracking if it became law. On September 30, 2026, Governor Newsom signed it. The next day, the California Court of Appeal handling a leading test case on that theory asked the parties whether SB 690 leaves anything for the court to decide.
The New Law, in Brief
SB 690 changes who may sue, not what Section 638.51 prohibits. Beginning January 1, 2027, new subdivision (d) of Penal Code Section 637.2 will provide that only the California Attorney General may bring a civil action against a private actor for an alleged Section 638.51 violation arising from conduct on a website, online application, or mobile application. The limitation will also apply retroactively to qualifying claims that remain pending on January 1, 2027, in actions commenced during the preceding two years. The law does not repeal Section 638.51 or make the underlying conduct lawful; it reserves civil enforcement of the covered claims to the Attorney General as of January 1. Private claims under Sections 631 and 632 of CIPA also remain available.
The Court Responds the Next Day
Variety Media, LLC v. Superior Court (No. B350578) had been argued and submitted on August 25, 2026. The court’s tentative ruling had something for both sides. It rejected the argument that “pen register” is limited to telephone equipment but tentatively concluded that the plaintiff’s IP address theory did not satisfy the statute because the visitor’s IP address identified the source of the communication rather than its destination. The tentative ruling was not a final or precedential opinion.
On October 1, the court withdrew the submission on its own motion and requested supplemental letter briefs addressing the effect of SB 690. It noted that the plaintiff filed the underlying action on January 23, 2025, asserting a single cause of action under Section 638.51. It directed the parties to address two questions: whether SB 690 makes the writ proceeding moot and, if so, whether an exception to mootness applies, citing Cucamongans United for Reasonable Expansion v. City of Rancho Cucamonga, 82 Cal. App. 4th 473, 479–80 (2000). The plaintiff’s brief is due October 8, the defendant’s response is due October 15, and the case is scheduled for resubmission on October 15.
Our Take
Timing is the first question. SB 690 has been enacted but will not become operative until January 1, 2027. Until then, private plaintiffs may continue to assert the existing cause of action, although a qualifying claim that remains pending on January 1 would fall within the new retroactivity provision. The court has therefore asked whether it can still grant meaningful relief in the writ proceeding or whether the approaching operative date and retroactive elimination of the plaintiff's remedy make the dispute moot.
The second question is whether the court should reach the merits even if the proceeding is moot. Cucamongans identifies three discretionary exceptions to mootness: when the case presents an issue of broad public interest likely to recur, when there may be a recurrence of the controversy between the parties, and when a material question remains for the court’s determination.
In Variety Media, the broad public interest exception may receive particular attention. Although private plaintiffs will lose the covered remedy on January 1, the Attorney General will retain enforcement authority, and Section 638.51’s substantive prohibition will remain unchanged. A published opinion defining what qualifies as an online “pen register” could therefore continue to affect Attorney General enforcement and Section 638.51 matters outside SB 690’s private action limitation.
There is also an institutional reason for caution. Deciding the merits would mean construing a statute whose civil enforcement, for the covered conduct, will soon rest with the Attorney General, in a private action whose remedy is scheduled to be withdrawn. The court may conclude that a future case presenting a live controversy is the better vehicle for resolving the statutory question.
What Businesses Should Do Now
- Defendants in pending Section 638.51 matters commenced on or after January 1, 2025: Determine whether the action falls within SB 690’s retroactivity provision, bring the new law to the court’s attention, and evaluate the appropriate procedural relief in light of the claim’s posture and the January 1 operative date
- Companies holding demand letters: Reassess demands resting solely on a private Section 638.51 website or app theory. Enactment substantially reduces their leverage because the private remedy is scheduled to disappear on January 1, including for qualifying pending claims. Demands asserting developed claims under Section 631, Section 632, or another surviving theory require separate analysis.
- Compliance teams: Do not scale back cookie, pixel, SDK, or tracking technology governance. Private claims under other CIPA provisions remain available, as do other federal and state claims and California Attorney General enforcement. Continue identifying active technologies, testing consent and opt-out states, evaluating the information transmitted and its recipients, reviewing contractual restrictions, and confirming that public disclosures match actual operation.
Once the Court of Appeal decides whether Variety Media survives SB 690, we will provide an update in the AI Law and Policy Navigator.
Related Professionals